diff options
Diffstat (limited to 'usr.bin/file/magic.5')
| -rw-r--r-- | usr.bin/file/magic.5 | 242 |
1 files changed, 242 insertions, 0 deletions
diff --git a/usr.bin/file/magic.5 b/usr.bin/file/magic.5 new file mode 100644 index 0000000..3b88eac --- /dev/null +++ b/usr.bin/file/magic.5 @@ -0,0 +1,242 @@ +.\" +.\" $FreeBSD$ +.\" +.\" install as magic.4 on USG, magic.5 on V7 or Berkeley systems. +.\" +.Dd December 08, 2000 +.Dt MAGIC 5 "Public Domain" +.Os +.Sh NAME +.Nm magic +.Nd file command's magic number file +.Sh DESCRIPTION +This manual page documents the format of the magic file as +used by the +.Nm +command, version 3.33. The +.Nm file +command identifies the type of a file using, +among other tests, +a test for whether the file begins with a certain +.Em "magic number" . +The file +.Pa /usr/share/misc/magic +specifies what magic numbers are to be tested for, +what message to print if a particular magic number is found, +and additional information to extract from the file. +.Pp +Each line of the file specifies a test to be performed. +A test compares the data starting at a particular offset +in the file with a 1-byte, 2-byte, or 4-byte numeric value or +a string. +If the test succeeds, a message is printed. +The line consists of the following fields: +.Bl -tag -width indent +.It offset +A number specifying the offset, in bytes, into the file of the data +which is to be tested. +.It type +The type of the data to be tested. +The possible values are: +.Bl -tag -width indent +.It byte +A one-byte value. +.It short +A two-byte value (on most systems) in this machine's native byte order. +.It long +A four-byte value (on most systems) in this machine's native byte order. +.It string +A string of bytes. +The string type specification can be optionally followed +by /[Bbc]*. The +.Dq B +flag compacts whitespace in the target, which must contain +at least one whitespace character. +If the magic has "n" consecutive blanks, the target needs +at least "n" consecutive blanks to match. +The +.Dq b +flag treats every blank in the target as an optional blank. +Finally the +.Dq c +flag, specifies case insensitive matching: lowercase characters +in the magic match both lower and upper case characters in the +targer, whereas upper case characters in the magic, only much +uppercase characters in the target. +.It date +A four-byte value interpreted as a unix date. +.It beshort +A two-byte value (on most systems) in big-endian byte order. +.It belong +A four-byte value (on most systems) in big-endian byte order. +.It bedate +A four-byte value (on most systems) in big-endian byte order, +interpreted as a unix date. +.It leshort +A two-byte value (on most systems) in little-endian byte order. +.It lelong +A four-byte value (on most systems) in little-endian byte order. +.It ledate +A four-byte value (on most systems) in little-endian byte order, +interpreted as a unix date. +.El +.El +.Pp +The numeric types may optionally be followed by +.Em & +and a numeric value, +to specify that the value is to be AND'ed with the +numeric value before any comparisons are done. Prepending a +.Em u +to the type indicates that ordered comparisons should be unsigned. +.Bl -tag -width indent +.It test +The value to be compared with the value from the file. If the type is +numeric, this value +is specified in C form; if it is a string, it is specified as a C string +with the usual escapes permitted (e.g. \en for new-line). +.It "" +Numeric values +may be preceded by a character indicating the operation to be performed. +It may be +.Em = , +to specify that the value from the file must equal the specified value, +.Em < , +to specify that the value from the file must be less than the specified +value, +.Em > , +to specify that the value from the file must be greater than the specified +value, +.Em & , +to specify that the value from the file must have set all of the bits +that are set in the specified value, +.Em ^ , +to specify that the value from the file must have clear any of the bits +that are set in the specified value, or +.Em x , +to specify that any value will match. +If the character is omitted, +it is assumed to be +.Em = . +.It "" +Numeric values are specified in C form; e.g. +.Em 13 +is decimal, +.Em 013 +is octal, and +.Em 0x13 +is hexadecimal. +.It "" +For string values, the byte string from the +file must match the specified byte string. +The operators +.Em = , +.Em < +and +.Em > +(but not +.Em & ) +can be applied to strings. +The length used for matching is that of the string argument +in the magic file. This means that a line can match any string, and +then presumably print that string, by doing +.Em >\e0 +(because all strings are greater than the null string). +.It message +The message to be printed if the comparison succeeds. If the string +contains a +.Xr printf 3 +format specification, the value from the file (with any specified masking +performed) is printed using the message as the format string. +.El +.Pp +Some file formats contain additional information which is to be printed +along with the file type. A line which begins with the character +.Em > +indicates additional tests and messages to be printed. The number of +.Em > +on the line indicates the level of the test; a line with no +.Em > +at the beginning is considered to be at level 0. +Each line at level +.Em n+1 +is under the control of the line at level +.Em n +most closely preceding it in the magic file. +If the test on a line at level +.Em n +succeeds, the tests specified in all the subsequent lines at level +.Em n+1 +are performed, and the messages printed if the tests succeed. The next +line at level +.Em n +terminates this. +If the first character following the last +.Em > +is a +.Em \&( +then the string after the parenthesis is interpreted as an indirect offset. +That means that the number after the parenthesis is used as an offset in +the file. +The value at that offset is read, and is used again as an offset +in the file. +Indirect offsets are of the form: +.Em (x[.[bslBSL]][+-][y]) . +The value of +.Em x +is used as an offset in the file. +A byte, short or long is read at that offset +depending on the +.Em [bslBSL] +type specifier. +The capitalized types interpret the number as a big endian value, whereas +a small letter versions interpret the number as a little endian value. +To that number the value of +.Em y +is added and the result is used as an offset in the file. +The default type +if one is not specified is long. +.Pp +Sometimes you do not know the exact offset as this depends on the length of +preceding fields. +You can specify an offset relative to the end of the +last uplevel field (of course this may only be done for sublevel tests, i.e. +test beginning with +.Em > Ns ). +Such a relative offset is specified using +.Em & +as a prefix to the offset. +.Sh BUGS +The formats +.Em long , +.Em belong , +.Em lelong , +.Em short , +.Em beshort , +.Em leshort , +.Em date , +.Em bedate , +and +.Em ledate +are system-dependent; perhaps they should be specified as a number +of bytes (2B, 4B, etc), +since the files being recognized typically come from +a system on which the lengths are invariant. +.Pp +There is (currently) no support for specified-endian data to be used in +indirect offsets. +.Sh SEE ALSO +.Xr file 1 +.\" +.\" From: guy@sun.uucp (Guy Harris) +.\" Newsgroups: net.bugs.usg +.\" Subject: /etc/magic's format isn't well documented +.\" Message-ID: <2752@sun.uucp> +.\" Date: 3 Sep 85 08:19:07 GMT +.\" Organization: Sun Microsystems, Inc. +.\" Lines: 136 +.\" +.\" Here's a manual page for the format accepted by the "file" made by adding +.\" the changes I posted to the S5R2 version. +.\" +.\" Modified for Ian Darwin's version of the file command. |
